*** This bug is a security vulnerability ***
Private security bug reported:
Each eCryptfs file has metadata associated with it that is normally
stored in the header of the file. The metadata is stored in "packet"
form according to RFC 2440 "OpenPGP Message Format". Each packet has
a header section itself, which has fields such as the packet length.
When reading the packet contents, the packet length field is used for
the memcpy to the destination buffer but is not checked against the size
of the destination buffer. This could result in a buffer overflow if a
malicious user hand-modifies the packet length field.
** Affects: ecryptfs
Importance: Critical
Assignee: Tyler Hicks (tyhicks)
Status: In Progress
** Tags: kernel
--
Check max buffer lengths when parsing metadata packets
https://bugs.launchpad.net/bugs/401810
You received this bug notification because you are a member of eCryptfs,
which is a direct subscriber.
Status in eCryptfs - Enterprise Cryptographic Filesystem: In Progress
Bug description:
Each eCryptfs file has metadata associated with it that is normally stored in
the header of the file. The metadata is stored in "packet" form according to
RFC 2440 "OpenPGP Message Format". Each packet has a header section itself,
which has fields such as the packet length. When reading the packet contents,
the packet length field is used for the memcpy to the destination buffer but is
not checked against the size of the destination buffer. This could result in a
buffer overflow if a malicious user hand-modifies the packet length field.
_______________________________________________
Mailing list: https://launchpad.net/~ecryptfs
Post to : [email protected]
Unsubscribe : https://launchpad.net/~ecryptfs
More help : https://help.launchpad.net/ListHelp
